7
7
8
8
experimental::[]
9
9
10
- A sibling pipeline that detects, spikes, dips, and change points in a metric. Given a distribution of values
11
- provided by the sibling multi-bucket aggregation, this aggregation indicates the bucket of any spike or dip
12
- and/or the bucket at which the largest change in the distribution of values, if they are statistically significant.
10
+ A sibling pipeline that detects, spikes, dips, and change points in a metric.
11
+ Given a distribution of values provided by the sibling multi-bucket aggregation,
12
+ this aggregation indicates the bucket of any spike or dip and/or the bucket at
13
+ which the largest change in the distribution of values, if they are
14
+ statistically significant.
15
+
16
+ TIP: It is recommended to use the change point aggregation to detect changes in
17
+ time-based data, however, you can use any metric to create buckets.
13
18
14
19
15
20
@@ -18,8 +23,8 @@ and/or the bucket at which the largest change in the distribution of values, if
18
23
19
24
`buckets_path`::
20
25
(Required, string)
21
- Path to the buckets that contain one set of values in which to detect a change point. There must be at least 22 bucketed
22
- values. Fewer than 1,000 is preferred.
26
+ Path to the buckets that contain one set of values in which to detect a change
27
+ point. There must be at least 22 bucketed values. Fewer than 1,000 is preferred.
23
28
For syntax, see <<buckets-path-syntax>>.
24
29
25
30
==== Syntax
@@ -42,8 +47,9 @@ A `change_point` aggregation looks like this in isolation:
42
47
43
48
`bucket`::
44
49
(Optional, object)
45
- Values of the bucket that indicates the discovered change point. Not returned if no change point was found.
46
- All the aggregations in the bucket are returned as well.
50
+ Values of the bucket that indicates the discovered change point. Not returned if
51
+ no change point was found. All the aggregations in the bucket are returned as
52
+ well.
47
53
+
48
54
.Properties of bucket
49
55
[%collapsible%open]
@@ -63,11 +69,14 @@ The found change point type and its related values. Possible types:
63
69
+
64
70
--
65
71
* `dip`: a significant dip occurs at this change point
66
- * `distribution_change`: the overall distribution of the values has changed significantly
67
- * `non_stationary`: there is no change point, but the values are not from a stationary distribution
72
+ * `distribution_change`: the overall distribution of the values has changed
73
+ significantly
74
+ * `non_stationary`: there is no change point, but the values are not from a
75
+ stationary distribution
68
76
* `spike`: a significant spike occurs at this point
69
77
* `stationary`: no change point found
70
- * `step_change`: the change indicates a statistically significant step up or down in value distribution
78
+ * `step_change`: the change indicates a statistically significant step up or
79
+ down in value distribution
71
80
* `trend_change`: there is an overall trend change occurring at this point
72
81
--
73
82
@@ -138,5 +147,6 @@ The request returns a response that is similar to the following:
138
147
<2> The number of documents in that bucket.
139
148
<3> Aggregated values in the bucket.
140
149
<4> Type of change found.
141
- <5> The `p_value` indicates how extreme the change is; lower values indicate greater change.
150
+ <5> The `p_value` indicates how extreme the change is; lower values indicate
151
+ greater change.
142
152
<6> The specific bucket where the change occurs (indexing starts at `0`).
0 commit comments